Cross-Site Scripting (XSS) in jquery

Description

Affected versions of jquery interpret text/javascript responses from cross-origin ajax requests, and automatically execute the contents in jQuery.globalEval, even when the ajax request doesn’t contain the dataType option.

Recommendation

Update the jquery package to the latest compatible version. Followings are version details:

• Affected version(s): **>= 1.12.3, < 3.0.0

  < 1.12.2**

• Patched version(s): **3.0.0

  1.12.2**

References

• GHSA-rmxg-73gg-4p98
• access.redhat.com
• ics-cert.us-cert.gov
• kb.pulsesecure.net
• lists.apache.org
• seclists.org
• security.netapp.com
• snyk.io
• sw.aveva.com
• www.oracle.com
• www.tenable.com
• lists.opensuse.org
• packetstormsecurity.com
• security.snyk.io
• web.archive.org
• CVE-2015-9251
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• jQuery vulnerable to Cross-Site Scripting (XSS) - CVE-2011-4969
• Cross-site Scripting (XSS) - Stored in crud-file-server - CVE-2018-3726
• CleverTap Web SDK is vulnerable to DOM-based Cross-Site Scripting (XSS) via window.postMessage - CVE-2026-26862
• Cross-site Scripting in tableexport.jquery.plugin - CVE-2022-1291

Tags:

npm

jquery